A Shared Pilot-Autopilot Control Architecture for Resilient Flight

Transcription

1 A Shared Pilot-Autopilot Control Architecture for Resilient Flight Amir B. Farjadian, Benjamin Thomsen, Anuradha M. Annaswamy, and David D. Woods Abstract We address the problem of flight control in the presence of actuator anomalies. A shared control architecture that includes the actions of both a human pilot and an autopilot is proposed to ensure resilient tracking performance in the presence of anomalies. The pilot is tasked with higher-level decision making tasks such as anomaly detection, estimation and command regulation. The autopilot is assigned a lower-level task of accurate command following. The main innovation in the proposed shared architecture is the use of human pilot in utilizing the concepts of Capacity for Maneuver (CfM) and Graceful Command Degradation (GCD), both of which originate in Social Sciences. Together, they provide guidelines for a system to be resilient, which corresponds to the system s readiness to unforeseen events. The proposed design incorporates elements from adaptive control theory under the control of human pilot. The shared control architecture is shown to be capable of achieving maximum CfM while allowing minimal GCD, as well as satisfactory command following post-anomaly, resulting in resilient flight capabilities. The proposed controller is analyzed in a simulation study of a nonlinear F-16 aircraft under actuator anomalies. It is shown through numerical studies that under suitable inputs from the pilot, the shared controller is able to deliver a resilient flight. Index Terms Resilient Control, Capacity for Maneuver, Graceful Command Degradation, Cyber-Physical Systems, Flight Control, Adaptive Control, Resilience Engineering. F I. INTRODUCTION LIGHT ANOMALIES may occur due to a variety of reasons such as electromechanical damage, sensor faults, severe environmental disturbances, or direct failures in the vehicle control surfaces or engines. A standard practice in flight control for aerial vehicles is to design a resident flight system so as to ensure the desired performance, such as tracking pilot / guidance commands robustly during operations while minimizing dependencies on possible perturbations in the aircraft dynamics caused by environmental disturbances, This research is supported by funding from National Science Foundation, Grant No Amir B. Farjadian is with Active Adaptive Control Lab, Department of Mechanical Engineering, Massachusetts Institute of Technology, Cambridge, MA, USA ( amirbf@mit.edu). Benjamin Thomsen is with Active Adaptive Control Lab, Department of Mechanical Engineering, Massachusetts Institute of Technology, Cambridge, MA, USA ( thomsen@mit.edu). Anuradha Annaswamy is with Active Adaptive Control Lab, Department of Mechanical Engineering, Massachusetts Institute of Technology, Cambridge, MA, USA ( aanna@mit.edu). David Woods is with Cognitive Systems Engineering Laboratory, Department of Integrated Systems Engineering, Ohio State University Columbus, OH, ( woods2@osu.edu). control deficiencies or sensor failures. The goal of a control design is to establish an envelope, over which performance is robust in the face of disturbances, but the design still has limits--disturbances, failures and surprising events can occur that fall outside the envelope of robust performance. Systems can be brittle when events challenge its design/performance envelope. Resilience, in part, refers to mechanisms that allow a system to extend its performance when events challenge boundaries [1]. Defining resilience as the property of a system that characterizes its ability to withstand and recover from extreme and high impact disturbances, and robustness as an ability to withstand nominal disturbances, the question that we address in this paper is if flight controllers could be designed to not only be robust but also resilient. Of particular interest is the design of a resilient flight controller that retains the desired tracking performance in the presence of severe operational anomalies. The approach that we propose to achieve our goal is shared control. One way to extend the control envelope is the use of shared control architectures where human controllers supplement flight control automation. As the capability of the automated controller to keep pace with growing disturbances saturates, the human flight crew takes over more responsibilities in flight control. In such an event, it is important to deploy a shared control architecture which addresses the problem of bumpy transfers of control from the first stage (automated) controller to the second stage (human) controller. Current architectures for shared control generally assume a partially autonomous machine does all of the work to handle variability and disturbances until external demands imposed on the machine exceed the automation's capabilities to handle the situation and then control is transferred to people who have to take over when the situation is already quite difficult to handle, for example as the control surfaces reach the limit of their control authority (i.e., as they saturate). This class of architectures virtually guarantees bumpy and late transfers of control that increase the risk of decompensation inability of a joint human-machine control system to keep pace with growing or cascading demands [3]. In real cases of human supervision of automation based on this architecture, the bumpy and late transfers of control have contributed to actual accidents [2], [30]. This paper addresses the question: can shared flight control systems be designed to be more resilient than the standard approach? The paper specifies and demonstrates the performance of a new design for resilient shared flight control. The new architecture provides desired tracking performance as operational anomalies challenge the performance of the first stage

2 automated controller and the second stage human pilot gets engaged bumplessly. In order to achieve a resilient control design, we combine adaptive control [5] with work from cognitive engineering that studies how people add resilience to complex systems [2-4]. This design is based on two concepts in particular, Capacity for Maneuver (CfM), and Graceful Command Degradation (GCD). CfM is the system s reserved capacity that will remain after the occurrence of an anomaly [3]. It is hypothesized that resiliency is rooted in and achieved via monitoring and regulation of the system s CfM [4]. In an engineering context, viewing the actuator input power as the system s capacity, and noting that a fundamental capacity limit exists in all actuators in the form of magnitude saturation, one can define a CfM as the distance between the control input and saturation limits. The need to avoid actuator saturation, and therefore increase CfM, becomes even more urgent in face of anomalies which may push the actuators to their limits. With such a definition, we will investigate in this paper if a resilient flight control system can be designed with the optimization of the CfM in mind. The second concept that we utilize to design a resilient flight controller is GCD. The underlying problem of interest is performance in the presence of severe anomalies. Typical performance goals in a flight control problem include satisfactory tracking of commands. However, delivering the same command both pre- and post-anomaly may not be feasible especially if the anomalies cause a significant loss of actuator effectiveness. GCD is proposed as an inherent metric adopted by humans [2] that will allow the underlying system to function so as to retain a target CfM. In other words, a human may introduce a certain amount of GCD as a control variable, tuned in a way that permits a system to reach its targeted CfM. The control architecture that we propose in this paper makes use of such a strategy. With resilient control defined for the purposes of this paper as the procurement of the optimal CfM with minimal GCD while delivering high tracking performance, we will design the overall shared architecture so as to have the flight control system perform resiliently in the face of anomalies. The control architecture proposed in this paper consists of shared decision making between the human pilot and the adaptive autopilot. The presence of an anomaly imposes a number of difficult challenges, all of which have to be dealt with quickly and correctly. In order to meet these challenges, we contend that, both the human pilot and an advanced autopilot having adaptive and learning capability need to be utilized. In the shared architecture that is proposed in this paper, the human pilot will be allocated higher-level cognitive tasks such as a perception of the anomaly, and an estimate of allowable GCD that will ensure maximum CfM. The adaptive autopilot on the other hand will be tasked with carrying out fast inner-loop decisions such as adaptive articulation of control surfaces that will ensure command tracking in a stable manner. Adaptive control systems were created to control dynamic processes in the presence of uncertainties [5]. With successes reported in flight control, process control, and automotive control, adaptive control consists of a self-tuned computational mechanism that adapts to the uncertainties by allowing the control parameters to be adjusted so as to minimize a suitably constructed performance error. Since the problem that is addressed in this paper is flight control in the presence of uncertainties, using an autopilot that is based on an adaptive control principle is an apt solution, and forms an important component of our shared control architecture. The adaptive controller we propose will be built on the principles proposed in [6]-[8]. The second aspect of the proposed shared controller is the human-pilot action. A number of aircraft accidents have been reported in the literature (ex. US Airways 1549 [9], El Al 1862 [10], Delta Air Lines 1141 [11], Air Florida 90 [12]). During those unpredictable events pilots showed a fair amount of understanding of the ongoing anomalies. In these examples, pilots have perceived and reported a variety of failures such as losing thrust in both engines due to birds encounter (US Airways 1549), an engine fire followed by losing another engine (El Al 1862), an engine failure (Delta Air Lines 1141), and inadvertently stalling the aircraft (Air Florida 90). As a potential remedy to these types of events, we postulate that pilots perceive the presence of the anomalies within a certain reaction time [13], [42] and they transmit estimates of these failures to the autopilot. And as mentioned above, in addition to these estimates, we propose that the pilot also inputs an estimate of allowable GCD that can be tolerated in a given mission while ensuring that a CfM remains for safe performance in the future. In order to formally analyze flight control anomalies in closed-loop dynamics of a piloted aircraft, mathematical models of a human pilot behavior need to be considered. Detailed models of the pilot behavior, especially at frequencies where stable feedback action is most urgently needed, have been developed by McRuer [14] and Hess [15]- [17]. These models have been studied by Hess [16]-[17] to understand a pilot s actions following significant anomalous events. Mulder et al., [41] examined the weaknesses in [14] and provide modifications based on studies of human pilots. The results of these papers are utilized in determining the pilot s role in our proposed shared control architecture. Additional studies of experienced pilots when it comes to recognizing anomalies and modifying controller response have been carried out in [34-41]. In [34-38], Sarter and Woods conducted an extensive set of empirical studies with line pilots on actual advanced aircraft in full scope simulation studies. The results on human interaction with cockpit automation showed that flight crews are sensitive to anomalies especially when conditions do not match expectations (do not fit internal representations of expected aircraft behavior under automatic control in different flight contexts). These studies also show that flight crews ability to notice anomalies in automation behavior strongly depends on the design of cockpit displays, for example, tactile displays greatly increase the speed and reliability of anomaly recognition without interfering with other pilot tasks [39]. In [41] Mulder et al., point out that the capability of human controllers to recognize anomalies grows

3 with experience the Internal Representation (IR), the quality of which increases with exposure and experience, that is the critical driver behind human control adaptations." (p. 472). A recent industry-wide review [40] drawing on diverse data sources supports the results from the full scope simulator studies. The results from the above studies are suitably integrated into our shared control architecture. The overall schematic of the control architecture proposed in this paper is shown in Fig. 1, which consists of perception and adaptation components. The perception component consists of both anomaly recognition and estimation. The adaptation component determines how the control input should be altered in the face of an anomaly. Such a shared task distribution between a human pilot and autopilot is similar to the distinction between actions in the face of abnormal as opposed to unexpected conditions [2], [18]. Anomalies could cause discrepancies between what is observed and what is expected (i.e. unexpected), or discrepancies between observed and desired states (i.e. abnormal). While the abnormal conditions may be addressable by simply including an advanced autopilot, the unexpected discrepancies are far more complex and requires elaborate decision-making such as findings-to-be-explained or diagnostic reasoning followed by quick corrective actions [2]. Our focus in this paper is on the case of unexpected conditions as we propose a shared pilotautopilot decision making architecture. Similar task distributions have been reported in our earlier papers, [19]- [20]. Fig. 1. Shared flight control architecture composed of pilot and autopilot. The specific adaptive autopilot that we use combines the architecture from [8] and [21]-[23]. The advantage of the former is the ability to gracefully degrade the command tracking requirement to retain sufficient CfM and prevent actuator saturation. The advantage of the latter is to ensure a smooth tracking performance even with constraints on the control effort. By combining suitable elements of these two control solutions we will show that when anomalies occur, and following the pilot input, the adaptive controller determines a control solution that not only guarantees bounded solutions but also minimizes the command tracking error. The rest of the paper is organized as follows. The problem statement is given in Section II. The shared control architecture is described in Section III. Extensive numerical studies are carried out using a high-fidelity fighter aircraft model composed of 5 states, 2 control inputs and 2 outputs in Section IV. In this section, we also compare the proposed architecture with other non-shared control solutions based on only autopilots, which include a standard optimal control approach as in [24], and an adaptive control approach using multiple inputs as in [7] and similar to [6]. The anomalies considered are successive losses of actuator effectiveness. Several performance metrics related to CfM and GCD are also proposed in Section IV, which demonstrate that a shared controller out-performs all other controllers. Summary and conclusions are provided in Section V. II. THE SHARED CONTROLLER The model of the aircraft to be controlled is assumed to have the dynamics: x (t) = Ax(t) + BΛ f u(t) + d + Φ T f(x) (1) where x R n and u R m are deviations around a trim condition in aircraft states and control input, respectively, d represents uncertainties associated with the trim condition, and the last term Φ T f(x) represents higher order effects due to nonlinearities. A is a (n n) system matrix and B is a (n m) input matrix, both of which are assumed to be known, with (A, B) controllable, and Λ f is a diagonal matrix that reflects a possible actuator anomaly with unknown positive entries λ fi. It is assumed that the anomalies occur at time t a, so that λ fi = 1 for 0 t < t a, and λ fi switches to a value that lies between 0 and 1 for t > t a. Finally it is assumed that the higher order effects are such that f(x) is a known vector that can be determined at each instant of time, while Φ T is an unknown vector parameter. Such a dynamic model is often used in flight control problems [25]. The goal is to choose the control input u so that the plant state x follow the desired command, which is suitably altered so as to account for the presence of anomalies. The control input u is assumed to be position / amplitude limited and modelled as follows: u i (t) = u maxi sat ( u c (t) u ci (t), u ci (t) u maxi i ) = { (2) u maxi u maxi (t)sgn (u ci (t)), u ci (t) > u maxi where u maxi for i = 1,, m are the physical amplitude limits of actuators, and u ci (t) are the control inputs to be determined by the shared control architecture. The functions sat( ) and sgn( ) denote saturation and sign functions, respectively. Our proposed shared control architecture consists of the human pilot and adaptive autopilot (Fig. 1) providing perception and adaptation in response to actuator anomalies. The details of each control unit are provided in the following sections. A. Autopilot: μ-mod adaptive control A typical procedure in any adaptive control design is to generate the desired command for the plant state to follow using the notion of a reference model. This reference model in turn guides the selection of a control law such as a statefeedback controller with adjustable gains. The reference model is typically of the form [5]

4 x m(t) = A m x m (t) + B m r 0 (t) (3) where r 0 R k is a reference input, A m (n n) is a Hurwitz matrix, x m R n is the state of the reference model and (A m,b m ) is controllable. The input r 0 as well as A m and B m should be chosen such that x m corresponds to the desired reference system state response due to external commands. A relatively recent modification to this reference model is the use of a closed-loop reference model (CRM) as in [21]-[23]: where x m(t) = A m x m (t) + B m r 0 (t) Le(t) (4) e(t) = x(t) x m (t) (5) and L < 0 is a constant or a matrix selected such that (A m + L) is Hurwitz. The goal of the adaptive autopilot is then to choose u ci (t) in (6) so that error e(t) tends to zero asymptotically with all signals in the adaptive system remaining bounded. The design of adaptive controllers in the presence of control magnitude constraints was first addressed in [6], with guarantees of closed-loop stability through modification of the error used for the adaptive law. The stability was shown to be global if the plant is open-loop stable, and semi-global otherwise with respect to the magnitude of the inputsaturation. The same problem was addressed in [8] where the effect of input saturation was accommodated through a modification of the reference model. The adaptation component that we propose in this paper is based on [8] which is termed the μ-mod adaptive control. In this design, in addition to the hard-limit imposed on the control input as in (2), a virtual limit (u maxi ) is introduced on the control input as: u adi (t), u adi (t) u maxi u ci (t) = { 1 (u (6) 1+μ ad i (t) + μ sgn (u adi (t)) u maxi ), u adi (t) > u maxi where u adi (t) is an adaptive control input of the form: u adi (t) = K x T (t)x(t) + K r T (t)r 0 (t) + d (t) + Φ T(t)f(x) (7) In (7) u maxi represents a virtual control limit, defined as: u maxi = (1 )u maxi, 0 < 1 (8) where is a virtual buffer that we introduce into the control input to help retain the desired CfM d, which is defined as CfM d = max i (u maxi u maxi ) (9) where index i refers to the i th control surface, max is the maximum operator over the i th index, and the actual CfM is defined as follows: c i (t) = u maxi u i (t) CfM + T = rms(min i (c i (t))) ta C i = c i (t)/u maxi CfM = CfM+ CfM d (10) where min is the minimum operator over the i th index, rms is the root mean square operator, and t a and T refer to the time of anomaly and final time, respectively. We will also introduce the variable C i which is a normalized derivative of instantaneous CfM to be used for presentation purposes. The control input (6) includes a parameter μ whose purpose is to move the control input away from saturation under demanding conditions. For example, if u adi (t) > u maxi, the extreme case of μ = 0 will simply set u ci = u adi, thereby removing the effect of the virtual limit imposed in (7). As μ is increased from zero, we note that the control input would decrease in magnitude and move towards the virtual saturation limit (u maxi ). It should be noted that such an increase therefore leads to an automatic increase in the CfM as well, by definition as in (10). The adaptive parameters K x (t) and K u (t) are adjusted as: K x (t) = Γ x x(t)e T (t)pb (11) K r (t) = Γ r r 0 (t)e T (t)pb d (t) = Γ d e T (t)pb Φ (t) = Γ f f(x(t))e T (t)pb K u (t) = Γ u u ad e T (t)pb m where P = P T is a solution of the Lyapunov equation (for Q > 0): A m T P + PA m = Q (12) Γ x = Γ x T > 0, Γ r = Γ r T > 0, Γ u = Γ u T > 0. The term u adi (t) is a correction to the reference command due to input saturation defined as: u adi (t) = u maxi sat ( u c i (t) u maxi ) u adi (t) (13) This correction is applied to the input into the CRM, similar to Lavretsky, et al. (2007) [8], as x m (t) = A mx m (t) + B m (r 0 (t) + K u T (t) u ad (t)) Le(t) (14) In other words, when an anomaly occurs, Λ f may be reduced, and to make up for this, the control input may tend to increase, causing it to saturate. To prevent this from occurring, we apply a correction in the form of u adi generating x m. And since the plant state will follow x m, this correction helps the control input from going into saturation. In particular, if at any time, the control input goes beyond certain limits, then u adi becomes nonzero, thereby suitably allowing a graceful degradation of x m from being chosen as in (3) to that as in (14). The GCD criterion is defined as:

5 GCD = x m (t) r 0 (t) / r 0 (t), t T 0 (15) where the norm function is defined in (31), T 0 denotes the interval of interest, r 0 (t) represents the reference input, and x m (t) represents the reference command that the aircraft is capable of following, and defined as in (14). The complete expansion of this term for the particular example is shown in (34). Fig. 2. The closed loop shared controller: Pilot/autopilot task contribution. It is easy to see from (13)-(15) that similar to CfM, as μ increases, GCD increases as well. This presents a trade-off between CfM and GCD which is of critical importance to achieving the desired mission objectives. While a larger CfM improves the responsiveness of the system to future anomalies, a lower bound on the reference command is necessary to finish the mission within practical constraints. That is, μ needs to be chosen so that GCD remains above a lower limit. As a result, selecting μ is a critical tradeoff in a resilient control system design. In this work, we define resiliency as the system s ability to trade-off CfM with GCD so as to deliver the same tracking performance both before and after the occurrence of an anomaly. The adaptive autopilot in (5)-(14) provides the required control input in (2) as a solution to the underlying problem. The autopilot includes several free parameters including μ in (7), in (9) and L in (14). The choice of sets the desired CfM and the choice of μ has a proportional effect both on CfM and GCD. In our proposed shared control design, we allocate the task of μ-selection to the human pilot, as described below. B. Human pilot: CfM-GCD Trade-off & anomaly estimation Upon occurrence of an anomaly, the pilot is the first responder to notice and perceive the malfunction through sensory interaction with the aircraft via pilot control interfaces, such as stick or a wheel, rudder pedals, as well control indicators / gages in the cockpit displays. Based on this premise, we postulate that the pilot plays a critical supervisory role to take care of unexpected conditions. In particular, we relegate the actions of (a) CfM-GCD trade-off, and (b) anomaly estimation, to the human pilot (see Fig. 2). These actions may be performed by the pilot as follows: 1) CfM Monitoring As a first step towards realizing a desired CfM, it is assumed that the pilot monitors the actual CfM, which is defined as in (10). This may be made possible through a display interface in the cockpit through the monitoring of actuator utilization [18]. While (10) may be one measure of CfM, alternate metrics based on the peak value of u(t) or an average value over a certain time interval may be used as well. 2) CfM-GCD Trade-off When an anomaly occurs, an increased CfM may be obtainable only at the expense of a degradation of the trackable command. As was argued in the previous section, μ is a compact parameter that directly impacts both CfM and GCD. We assume that the pilot is capable of determining the optimal CfM which corresponds to the maximum CfM that can be achieved with a minimum GCD. We therefore propose that with such expertise, the pilot determines the optimal μ and enters the parameter for the adaptive autopilot to use. 3) Anomaly Estimation The second task that we assign to the pilot is one of anomaly estimation. Noting that the anomaly, which is assumed to result in a loss of control effectiveness, is represented by Λ f in (1), we assume that pilot provides an estimate Λ fp of Λ f. In summary, the pilot is tasked with providing two pieces of information to the shared controller, μ and Λ fp (see Figure 2 for a schematic). The former provides the requisite GCD that allows the overall system to retain the desired CfM. The latter is a diagnosis of the anomaly as perceived by the pilot. C. The Shared Controller The goal of the shared controller is to choose u ci (t) in (6) so that error e(t) tends to zero asymptotically with all signals in the adaptive system remaining bounded. In addition to this standard goal, the shared controller also attempts to ensure that the closed-loop system achieves a certain CfM-GCD trade-off in (10) and (15) so as to ensure the tracking performance post-anomaly. The overall task distribution among human pilot and autopilot is shown in Fig. 2, where the human pilot and adaptive autopilot respond to an unexpected anomaly. While the autopilot is the default controller to provide the required tracking performance, the human pilot detects the presence of an anomaly. The pilot then provides two pieces of information to the adaptive autopilot, one that concerns an estimation of the anomaly, and another that decides the CfM-GCD trade-off. The first corresponds to Λ fp, and the latter to μ. The adaptive autopilot then uses these two pieces of information and computes (i) the trackable command, in the form of the reference model state x m, and (ii) the control input u that ensures that the plant state x tracks x m. As will be shown numerically in Section IV, the choice of μ directly impacts CfM (defined in (10)) with minimal addition of the term u adi. The adaptive autopilot ensures that x tracks the resulting x m. While μ is directly used in (6), Λ fp is utilized by the adaptive autopilot in the following manner. Because the expertise of the pilot, in general needs to be accommodated in the design of the shared controller, we introduce a new

6 parameter η which represents the pilot s rating. We assume that 0 < η 1 and is calculated based on the pilot s expertise, as a function of flying hours [26, 32-33]. One choice of η is given by η = f(fh) (16) where FH stands for hours of flight in the past 6 months and f(.) normalizes hours to eta. With this pilot-rating, we assume that an estimate Λ f of Λ f is used in the shared controller as Λ f = ηλ fp + (1 η)λ nom (17) where Λ nom is an identity matrix representing the nominal value of Λ f. We now choose the remaining free parameters of the adaptive controller as follows. These parameters include the reference model parameters A m, B m and the control parameters K x (0), K r (0), and K u (0). If no anomalies are present, then Λ nom = Λ f = I which implies that the plant state can follow the reference model state if the following conditions are satisfied: A m = A + BK x T (0) (18) K r T (0) = (A m 1 B) 1 B m = BK r T (0) K u T (0) = A m 1 B where K x (0) is computed using a linear quadratic regulator (LQR) method [24], and K r (0) is selected as in (18) to provide unity low frequency DC gain for the closed-loop system. When anomalies occur, Λ f I, and is estimated as Λ f using the pilot s input as explained above. This information is used to update A m, B m at t = t a when the anomaly occurs as A m = A + BΛ fk x T (t a ) (19) K r T (t a ) = (A m 1 B) 1 B m = BΛ fk r T (t a ) K u T (t a ) = A m 1 B The overall shared controller is summarized in (6)-(19). Using the procedure outlined in [8] and [23], it is easy to show that the adaptive controller proposed in (6)-(19) is guaranteed to generate globally bounded solutions and that e(t) tends to zero asymptotically, if the plant is open-loop stable; for unstable plants, a bounded domain of attraction can be established. The proof is omitted due to space limitations. The reader is referred to [27] for details of the proof. Due to the presence of magnitude constraints, the overall tracking error can be shown to be bounded and of the order of u ad. III. COMPARISON WITH OTHER CONTROLLERS To evaluate the performance characteristics of the shared controller, we compare our proposed method with conventional adaptive [7] and optimal controllers [24], as shown in Fig. 3. A. Adaptive Autopilot The adaptive controller is adopted from [7], where the f term, associated with the actuator s locking, is omitted due to in-applicability in the problem definition. Assuming the control input to the plant as in (2), the control input by the adaptive autopilot can be described as: u ci (t) = K x (t)x(t) + K r (t)r 0 (t) (20) The adaptive parameters K x (t), K r (t) and λ (t) are adjusted as: K x (t) = Γ x B T Pe u x T (21) K r (t) = Γ r B T Pe u r 0 T λ (t) = Γ λ diag( u)b T Pe u where P = P T is a solution of the Lyapunov equation (for Q > 0) A m T P + PA m = Q (22) Γ x = Γ x T > 0, Γ r = Γ r T > 0, Γ λ = Γ λ T > 0, and u(t) represents the control deficiency signal: u = u i u ci (23) and e u is the augmented error computed from the auxiliary error e as follows: e u = e e (24) e = A m e + B diag(λ ) u (25) The parameter λ is a vector, the elements of which are the current estimates of the diagonal terms of Λ f in (1). The adaptation laws in (21) are initialized using a baseline LQR control law, similar to (18). The LQR method is applied to calculate K x (0) using A and B, and the feedforward gain (K r ) is initialized to achieve unity DC gain in the closed-loop system. A m = A + BK x T (0) (26) K r T (0) = (A m 1 B) 1 B m = BK r T (0) The primary goal of the adaptive autopilot is to minimize the tracking error in normal and anomaly conditions. B. Optimal Control The optimal controller is formulated using a conventional LQR technique [24]. Considering (2), the optimal control input is generated as: u ci (t) = K x x(t) + K r r 0 (t) (27) The control gains (K x, K r ) are fixed and chosen similar to the initialization in (18) and (26). The LQR method is applied to calculate (K x (0) = K xlqr ) using A and B matrices (Λ f = I). The feedforward gain (K r ) is initialized to achieve unity DC gain in the closed-loop system as follows:

7 A m = A + BK x T (0) (28) K r T (0) = (A m 1 B) 1 B m = BK r T (0) The primary goal of the optimal autopilot is to minimize the tracking error under normal and anomaly conditions. TABLE I THE OPEN-LOOP SYSTEM MODEL PARAMETERS. A B Fig. 3. Different approaches applied to the flight control under anomaly, Top: proposed shared controller, Bottom: Optimal/adaptive/µ-mod adaptive autopilots. C. Situation Awareness of Pilots Pilots will have disparate levels of cognitive awareness of the anomalous situation, where they may be either situationaware or situation-unaware. We quantify these differences in the following manner, based on μ. Additionally, we associate a CfM metric to the human pilot and based on his/her reaction time. Our premise is that a situation-unaware pilot (SUP) has a longer reaction time (RT) compared to a situation-aware pilot (SAP), and hence a lower CfM [13]. These models will be included in our numerical studies as follows. 1) Situation Aware Pilot (SAP) The pilot has a high situation awareness, a small RT, and therefore can compute μ with a delay of RT. Moreover, he/she can perceive the anomaly as Λ fp leading to an estimate as in (17). This will be used in (19) to re-initialize the parameters in the reference model and controller gains in the adaptive autopilot. 2) Situation Unaware Pilot (SUP) In contrast to the SAP, the SUP is cognitively saturated and slow to respond, and possesses a large RT. He/she is therefore assumed to not be able to provide an anomaly estimate Λ fp. It is assumed that the pilot is capable of providing a μ after a large delay of RT. In the absence of pilot s anomaly estimate, the adaptive autopilot pursues the anomaly estimation process, which may exhibit poor performance. IV. NUMERICAL ASSESSMENT A. Simulation Example The control systems have been simulated in the flight control problem of the nonlinear longitudinal dynamics of a F- 16 aircraft model. The nonlinear model with two inputs and two outputs is considered, where the plant state x long = [h, θ, V, α, q] T contains the altitude, pitch angle, airspeed, angle of attack, and pitch rate, respectively. The plant input is u = [ el th ] T which are the elevator deflection and thrust force relative to trim, respectively. Table 1 gives the linearized system matrices at h 0 = ft and V 0 = 500 ft/s. For ease of exposition, the trim disturbance d and nonlinear parameter Φ were set to zeros. The corresponding adaptive laws for d and Φ in (11) were set to zero as well. The control objective is to track step-wise commands in altitude ( h = 80 ft) while regulating airspeed ( V = 0). To ensure zero steady-state command tracking error, the control model augments the plant state with the integral of the altitude command tracking error, h I t (t) = [h(τ) h cmd (τ)]dτ 0 (29) where h cmd (τ) is the commanded altitude. The plant state used in simulation is thus x long = [h I, h, θ, V, α, q] T. Two consecutive faults were introduced at 125 s and 215 s, resulting in post-anomaly actuator effectiveness of 30% and 10%, respectively. That is, it is assumed that both the elevator deflection and thrust inputs were compromised with the corresponding 2x2 matrix Λ f containing equal diagonal entries λ f with (see Figure 4). Fig 4. Timeline of flight scenario used in simulations. 1 t < 125 s λ f = { > t 125 s 0.1 t 215 s (30) In addition, it was assumed that the anomaly causes the deflection of the elevator to be limited. The elevator s saturation limits (u maxi ) were set to 3 deg, and the thrust

8 saturation limit to 1500 lbs above the nominal value associated with the steady-state trim condition. Inspired by [42], we assumed a reaction time of RT = 0.68 s for SAP and RT = 5 s for SUP in the shared controller. Additionally we assumed = 0.25 to specify the desired value for CfM in (9). All LQR designs in (19), (26) and (28) were computed using the state and input cost matrices (Q and R) given by B. Performance Metrics Q = diag(0.01, 0.01, 1, 10, 1, 1) R = diag(1, 1) To evaluate the control performance, the Euclidian norm and root mean squared error were used as follows: (x 1, x 2 ) = x x 2 2 (31) T 0 T rms(x) 0 = ( 1 T x(τ)2 dτ) 2, T > 0 (32) where T is the integration period. With these definitions, we chose four different metrics to assess the controllers performance in the above example of command tracking in height (h) and velocity (V). 1) Tracking performance (ρ) The command following characteristic, or change in root mean squared error (RMSE) before and after the first anomaly in each output state. RMSE i = rms(e i ) 0 t a 1 RMSE + i = rms(e i ) ta 1 ρ i = RMSE + i RMSE i (33) 1 T end where i = h, v, e h ft, e V ft/s are altitude and velocity tracking errors, RMSE is the root mean square error before the first anomaly and RMSE + is computed after the first anomaly to the end of simulation T end, t ai, i = 1,2 refers to first and second anomalies. 2) CfM Metric Using (10), the existing CfM with respect to the desired CfM is computed, where u maxi is the actuator saturation limit, with i = el, th. 3) Graceful Command Degradation (GCD) Using (15), and in this particular example, GCD is defined as follows: GCD h = h m (t) h 0 (t) / h 0 (t), t T 0 GCD V = V m (t) V 0 (t) / V 0 (t), t T 0 GCD = (GCD V + GCD h )/2 1 (34) where the norm function is defined in (31), and interval T 0 was chosen to cover the last cycle [390 s, 510 s]. The proposed GCD metric as in (34) presents a normalized scalar indicating the cumulative percentage of command degradation along both output states. Since transients may diminish with time, and (14) includes a feedback of the state error e(t), a choice of T 0 when e is small ensures that the term in (15) represents a reasonable measure of GCD. 4) Parameter Estimation Error After anomaly, the pilot may deliver an estimate (Λ fp ) which results in a parameter estimate (Λ f) as in (14) Λ f = diag(λ f Λ f) (35) where diag extracts the diagonal elements of the matrix argument, Λ f is the Euclidean norm of parameter estimation error, Λ f is the actual failure repressing the system and Λ fis the estimate computed from the pilot input in (14). Substituting (17) into (35), the following can be derived to relate the pilot s estimation error to the initial parameter estimation error. Λ f = diag(η (Λ f Λ fp ) + (1 η)(λ f Λ nom )) (36) where Λ fp is the pilot s input estimate, and η is the pilot s expertise from (16). The term Λ f Λ fp can be considered as pilot s estimation error ( Λ fp ). C. Results and Discussion The plant dynamics and reference model were considered as in (1)-(3). The shared controller was simulated using (5)-(19), µ-mod adaptive autopilot using (5)-(14), adaptive autopilot using (20)-(26) and optimal autopilot using (27)-(28). The simulation scenario as in Fig. 4 was used, where there is a 70% loss of actuator effectiveness followed by a second anomaly. Depending on the metric of interest, the second anomaly was assumed to be fixed at 10% or varied in a range 10% λ fi 30%. The shared controller as well as the adaptive and optimal controllers described in Section II and III were assessed using the metrics in (10), (15), (33), (34) and (36). The role of pilots, capacity for maneuver (CfM) and graceful command degradation (GCD) were quantified corresponding cases. TABLE II SUMMARY COMPARISON AMONG DIFFERENT CONTROLLERS. # Method RMSE (h,v) ρ (h,v) CfM* GCD 1 SUP (14e-4, 43e-4) (56e-4, 31e-3) e-4 2 SAP** (14e-4, 43e-4) (33e-4, 19e-3) e-4 3 SAP*** (14e-4, 43e-4) (0.1, 0.2) Optimal (20.88, 3.88) (233.8, 14.10) 0.74 NA 5 Adaptive (21.39, 3.86) (0.98, 1.59) 1.17 NA 6 μ-mod (14e-4, 43e-4) (12e-2, 32e-2) e-3 * CfM d = 0.75; NA: Not Applicable; SAP**: Λ f = 0.2; SAP***: Λ f = 0.4 Illustrative performance of the shared controller, adaptive and optimal autopilots are presented in Figures Figs. 5-6 show the details of the shared controller and corresponding analysis. Figs. 7-9 show the performance of the optimal, adaptive and μ-mod autopilots. Table II lists a summary of the

9 overall performance metrics in different controllers. Table III carries out a similar comparison in the case when the second anomaly was varied from 30% to 10%. Figs. 5-9 display the system variables in a similar format, with each figure consisting of 3 rows and 2 columns. The left column corresponds to the tracking performance and error and the right column to the control inputs and instantaneous CfM. In the left column, the first and second rows show the plant state outputs (h, V), reference model states (h, V ) when applicable, and desired commands (h 0, V 0 ), while the last row shows the instantaneous error (5) about each state output. In the right column, the first and second rows show the elevator ( el ) and thrust ( th ) deflections within the actual (u maxi ) and virtual saturation (u maxi ) limits, where applicable. The last row in right column shows C i as in (10). In each plot, the vertical lines correspond to the anomalies, and where applicable to the pilot input in the case of the shared controller. considering the low choice of μ, the SUP increases the value of μ to 3 which shows to be a not-large-enough value in the rest of flight maneuver, as the CfM reaches the zero limit multiple times (t > 220). On the other hand, and in this last period, the μ-mod autopilot starts lowering the desired command (h ) to restore the CfM and improve tracking error through the GCD effect as in (14). This is a compensatory action by the autopilot to account for the small μ as chosen by the situation unaware pilot. The SUP shared controller s performance pre- and post-anomaly is numerically listed in the 1 st row of Table II. Fig. 6. The shared controller with SAP: Left) Tracking performance; Right) Control inputs status. The vertical lines correspond to anomalies (t = 125 s, 215 s) and pilot s perception (t = s, s), when the pilot provided the anomaly estimate and also tuned the parameter μ, where μ(t = 0) = [1 1]; μ(t = ) = [10 1]; μ(t = ) = [30 1]. The instantaneous errors and CfMs are shown in the last column. Fig. 5. The shared controller with SUP: Left) Tracking performance; Right) Control inputs status. The vertical dashed lines at t = 125 s and 215 s indicate two subsequent anomalies. The vertical lines at t = 130 s and t = 220 s are the pilot inputs to tune the parameter μ, where μ(t = 0) = [1 1]; μ(t = 130) = [2 1]; μ(t = 220) = [3 1]. The instantaneous errors and normalized CfMs are shown in the last row. D. The Shared Controller Performance Fig. 5 shows the performance of the shared controller with a situation unaware pilot (SUP). The SUP is assumed to have a reaction time of RT = 5 s after which he/she will determine a μ. The 1 st anomaly occurs at t = 125 s and therefore the pilot is assumed to provide the first input at t = 130 s, which is a compensatory action by increasing μ to 2. Yet, notably the elevator still reaches the saturation limits, an indication of insufficient CfM. During this period (130 s t 215 s), and as shown in the right column, the elevator still reaches virtual saturation limits. After the second anomaly, at t = 220 s, and Fig. 6 shows the performance of the shared controller with a situation aware pilot (SAP). In contrast to the SUP, the SAP takes better decisions about μ and will also provide an anomaly estimate that will be used in the shared controller as in (19), faster after each anomaly. In this example, it was assumed that the SAP s estimation and rating are such that Λ f = 0.2. In addition, the SAP is assumed to have a reaction time RT = 0.68 s of providing the parameters. As shown in the right columns, and in contrast to SUP, the pilot actions keep the control system away from saturation limits throughout the flight maneuver. At the same time it achieves a better tracking error and lower command degradation. At t = , the SAP perceives the first anomaly and provides an anomaly estimation (Λ fp ) in addition to μ = 10. The higher choice of μ (as compared to SUP) is only to avoid actuator saturation since SAP has a better understanding of the anomaly magnitude and hence the requirements to lowering the ρ. Similarly and upon the second anomaly (t = s), the SAP delivers appropriate Λ fp and μ to avoid actuator saturation and achieve lower ρ. The responses in Fig. 6 show

10 that the shared controller tunes the reference model outputs (h, V ) suitably to minimize the tracking error. The SAP shared controller performance is numerically encapsulated in the 2 nd row of Table II. The 3 rd row is also dedicated to SAP but with a higher estimation error Λ f = 0.4 which seems to have a worse performance than SUP. It is important to note that the pilot (SUP/SAP) achieved stability and low tracking error by compromising the original command input (r 0 ), i.e. the notion of graceful command degradation. It is the unique feature of the shared controller to trade-off CfM with command degradation. When anomalies cause the control inputs to exceed beyond the virtual saturation limits, the autopilot has a built-in mechanism of relaxing the required control input magnitude by lowering the command magnitude. This effect is clearly shown in Figs. 5-6, where by tuning μ, the pilot has reduced the reference commands to increase the available CfM. Yet, the obvious question that can be raised from this feature is if such a command degradation is acceptable in a given mission context. While increasing μ can lead to more CfM, that change can also lead to excessive command degradation. Our hypothesis is to defer that decision to the human pilot who has the highest amount of information at the time. acceptable performance. Yet, upon the 2 nd anomaly the elevator control input ( el ) reaches the saturation limit and the lack of CfM leads to oscillatory behavior and poor tracking performance. As shown in the last row, the errors largely increase after the anomalies and the elevator C el reaches zero. Despite good performance under normal condition, the fixed gain optimal controller is not able to cope with uncertainties and deal well with anomalies. The 4 th row in Table II shows the numerical performance of this autopilot, which is the worst among other methods. Fig. 8 shows the performance of the adaptive autopilot during the flight scenario in Fig. 4. The adaptive controller shows an acceptable performance in the initial phase and even post-occurrence of the first anomaly. Yet, following the 2 nd anomaly, the control input reaches saturation limits, which impacts the output tracking performance. The adaptive controller has the potential to deal with uncertainty and estimate the new parameters, yet it runs out of control input (resources) to respond, and the absence of CfM results in poor performance. The 5 th row in Table II shows the numerical performance of adaptive autopilot better than the fixed-gain optimal autopilot but worse than the other methods. Fig. 7. The optimal autopilot: Left) Tracking performance; Right) Control inputs status. The vertical dashed lines at t = 125 s and 215 s indicate the two subsequent anomalies. The instantaneous error/cfm are shown in the last row. E. Comparison with Other Controllers To provide a benchmark comparison, the performance of optimal, adaptive and μ-mod adaptive autopilots are shown in Figs. 7-9, using the same simulation scenario as in Figs The summary results are also listed in the bottom rows of Table II. Table III provides a more comprehensive comparison over the full range of loss of actuator effectiveness at second anomaly (Λ f = [0.1:0.02:0.3]). The performance of optimal autopilot is shown in Fig. 7, where prior and post the first anomaly, the controller shows an Fig. 8. The adaptive autopilot: Left) Tracking performance; Right) Control inputs status. The vertical dashed lines at t = 125 s and 215 s indicate the two subsequent anomalies. The instantaneous error/cfm are shown in the last row. Fig. 9 shows the performance of the μ-mod adaptive autopilot. This autopilot has the ability to trade CfM with GCD, yet has a fixed predetermined μ=100. There is no pilot or mechanism to tune the μ in face of anomalies making the best selection for the CfM-GCD trade-off. Similar to the two autopilots, the μ-mod autopilot shows an acceptable performance before the 2 nd anomaly, yet suffers from actuator saturation afterwards. This is due to the very high magnitude of μ which is an initial design to prioritize CfM (over GCD). While the higher choice of μ could be advantageous in less severe anomalies (see Table III), it showed a counterproductive effect given the very high amount of anomaly and

11 plant nonlinearities. The 6 th row in Table II shows the numerical performance of this autopilot. trade off mechanism to improve tracking performance but suffers from a fixed gain. The advantageous effect of having a high μ (μ = 100) is observable in this result and in the range of anomalies mostly above 0.1. The adaptive and optimal autopilots follow these controllers with the worst performance and low CfM. F. Pilot s Contribution A primary component of the shared controller is the human pilot, whose contribution to estimation error is illustrated in Fig. 10. The top plot shows the pilot s parameter estimation input and the bottom plot shows the pilot s estimation error. Both plots are generated using algebraic simulations of (17) and (36) and by considering a scalar λ fi. The top contour is a direct demonstration of (17) showing the estimated parameter (λ f) by varying pilot s expertise (η) and estimate input (λ fp ). The range of parameters are selected as η = [0.1:0.01:1], and λ fp = [0.1:0.01:1]. Accordingly each point on the plot represents the estimated parameter (λ f) based on the pilot s input estimate (λ fp ) and expertise (η) using (17). The contour Fig. 9. The μ-mod adaptive autopilot: Left) Tracking performance; Right) Control inputs status. The vertical dashed lines at t = 125 s and 215 s indicate the two subsequent anomalies. The instantaneous error/cfm are shown in the last row. Table II shows the summary results for controllers, and associated performance metrics using a single simulation case as shown in Figures 5-9. All controllers show good performance prior to anomaly, yet their differences emerge in response to anomalies. Post-anomalies, the shared controller with SAP has the best RMSE +, resiliency metric and CfM. SAP s outstanding performance is followed by SUP and adaptive autopilot. This is due to the effect of managing CfM in each controller. lines show a hyperbolic effect, which is due to the ηλ fp product in (17). Moving along the λ fp -axis with (η = 0) results in high parameter estimate ( 1), due to the dominance of the second term (1 0)λ nom. It is the characteristic of the proposed model to undermine the pilot s input estimate in case of low expertise. Conversely, moving on the top along the λ fp - axis with (η = 1) delivers a parameter estimate exactly equal to the pilot s input. The pilot s input receives the highest weight in case of higher expertise (η). TABLE III COMPREHENSIVE CONTROLLER COMPARISON AVERAGED OVER A RANGE OF ANOMALY SEVERITIES. # Method ρ (h,v) CfM* GCD 1 Optimal (26.59, 5.43) 1.12 NA 2 Adaptive (3.68, 0.45) 1.24 NA 3 μ-mod adaptive (23e-3, 78e-3) e-4 4 SAP (28e-4, 18e-3) e-4 * CfM d = 0.75; ** Λ f = [0.1:0.02:0.3]; NA: Not applicable. Table III provides a more comprehensive comparison among the controllers by showing the result over a range of actuator effectiveness Λ f = [0.1:0.02:0.3]. Accordingly, the listed values are averaged over Λ f. We also assumed 0.2 parameter estimation error ( Λ f ) for SAP. Accordingly, the SAP shows the most resilient performance with post-anomaly error lower than pre-anomaly, while also achieving high CfM and GCD. The SAP is followed by μ-mod adaptive, adaptive and optimal autopilots in terms of ρ while they show similar CfM and GCD. The μ-mod adaptive autopilot uses the GCD-CfM Fig. 10. Pilot s estimate contribution; Top: Parameter estimate based on pilot s input and expertise; Bottom: Mean parameter estimation error based on the pilot s estimation error and expertise.

12 The second analysis, in the bottom plot, is the mean parameter estimation error based on the pilot s error and expertise. The range of parameters are the same as the top plot, with the addition of actuator effectiveness Λ f = [0:0.01:1], whose effect is averaged to produce a 2-D figure. The pilot estimation error is assumed to vary Λ f = [ 0.5: 0.01: 0.5]. Accordingly, each point on the contour corresponds to a specific pilot error ( λ fp = λ f λ fp ) and expertise (η) averaged over the full range of actuator effectiveness (Λ f = [0:0.01:1]). Similar to the top contour, higher values of expertise (η) is associated with less difference between the parameter estimation error ( λ f ) and pilot estimation error ( λ fp ). Lower range of η removes the sensitivity to the pilot error axis, leading to maximum error. While moving to the left of λ f -axis increases the final error ( λ f ), moving to the right mostly decreases the error. This is an interesting characteristic of this plot model, where pilot s under-estimation (e.g. λ f = 0.6, λ fp = 0.4) produces lower error than over-estimation (e.g. λ f = 0.4, λ fp = 0.6). Hence the pilot should avoid over-estimating the actuator effectiveness. G. Resilient Control As mentioned earlier, resilient control was defined as the system s ability to trade-off CfM with GCD so as to deliver the same tracking performance both before and after the occurrence of anomalies. As mentioned earlier, the choice of μ directly affects CfM and indirectly affects GCD. For any μ, the adaptive controller guarantees that the state error e goes to zero. From (6) and (10), it can also be observed that as μ increases, the rms value of e decreases. In summary, the choice of μ directly affects the resilience of the overall system. Given the performance of the shared controller, the question is how one chooses the best μ? Higher the μ, better the CfM, but at the expense of increased GCD. Greater the μ, greater the departure of the command signal r 0 (t) + K u T (t) u ad (t) from the original command signal r 0 (t). In general, the desired command may not be altered beyond certain acceptable limits. Too much command degradation, for instance, may lead to too long an arrival-time or, in extreme case scenarios, a nonarrival altogether at the destination. These limits in turn will, most likely, determine the achievable tracking performance and CfM and therefore the overall resilient control performance. We therefore propose that the ideal selection of μ be delegated to the pilot, as he or she may be aware of the allowable GCD and desirable CfM. The analysis tested the shared resilient controller performance relative to alternative autopilot designs using a numerical simulation based on a nonlinear F-16 aircraft. Primary assessment metrics used were CfM, GCD, tracking performance and parameter estimation error. The proposed shared controller showed superior performance over optimal, adaptive and μ-mod adaptive autopilots. V. IMPLICATIONS The Resilience Engineering agenda has aspired to develop mechanisms for resilient control [29]. This paper addresses that aspiration by providing a resilient control architecture based on regulating Capacity for Maneuver (CfM) and Graceful Command Degradation (GCD). Furthermore, this paper provides an architecture for shared resilient control with a specification of coordinated roles for the pilot and automatic controller. The pilot recognizes/estimates anomalous behavior and manages the value of parameter μ, which leads to a maximum CfM with a minimal GCD in the command, while the adaptive autopilot delivers tracking performance and stability. The paper provides a comparative test of the shared resilient control architecture for a specific flight control case and scenario. The architecture provides specific performance metrics, and the test provides detailed performance measures. The key finding is that the shared controller improved resilient performance for handling anomalous conditions. As a result, the test provides a potential standard for quantitative analysis of resilient performance. As a shared control design, the architecture provides a novel approach for coordinating human and automated roles. Shared control is based on human pilots recognizing and estimating size/trend of anomalous behaviors, and pilot commanding of a parameter μ, that governs how the autopilot controls the tradeoff between CfM and GCD. This new shared control architecture addresses the problem of bumpy transfers of control in current human-automation systems. Current forms of shared control virtually guarantee late transfers of control that increase the risk of decompensation inability of a human-machine system to keep pace with growing or cascading demands [3]. This risk has contributed to actual accidents [2], [30] where loss of vehicle control resulted from bumpy and late transfers from autopilot to human pilot. The shared resilient control architecture developed here demonstrates there are alternative architectures, and the simulation studies in this paper show that alternative shared control architectures can resolve the bumpy transfer of control problem. The paper also provides a demonstration of the value of theoretical advances in Resilience Engineering [1]-[4]. The Theory of Graceful Extensibility [4] specifies that adaptive units and networks (in this case the shared human and autopilot control) should regulate Capacity for Maneuver in order to be resilient in the face of anomalies that challenge normal function (in this case what an autopilot can handle by itself). The shared control architecture was developed to regulate Capacity for Maneuver. Other research results have shown that adaptive units at different scales can monitor their capacity for maneuver and can adapt to compensate when the risk of saturation gets too high [31]. This paper demonstrates that the general concept in the theory can be defined and used in specific control problems. This paper also shows that systems designed to regulate Capacity for Maneuver can produce improved performance in the face of anomalies. The end result is a new path forward for the design of shared human and machine systems that can reliably produce resilient performance in the face of disturbances, anomalies, and cascades that exceed the machine s capability alone. ACKNOWLEDGMENT This research is supported by funding from National

13 Science Foundation, Grant No with additional support from U.S. Department of Transportation, University Transportation Center (UTC) Program (DTRT13-G-UTC47). We would also like to thank Dr. Eugene Lavretsky, of Boeing Company, for his valuable inputs. REFERENCES [1] D. D. Woods, Four Concepts of Resilience and the Implications for Resilience Engineering, Reliability Engineering and Systems Safety, vol. 141, pp. 5-9, [2] D. D. Woods and E. Hollnagel, Joint Cognitive Systems: Patterns in Cognitive Systems Engineering, Boca Raton FL: Taylor & Francis, [3] D. D. Woods and M. Branlat, How Adaptive Systems Fail, in Resilience Engineering in Practice. E. Hollnagel, J. Paries, D. D.Woods, and J. Wreathall, Eds., Aldershot, UK: Ashgate, 2011, pp [4] D. D. Woods, The Theory of Graceful Extensibility, Environment Systems and Decisions, in press, [5] K. S. Narendra, A. M. Annaswamy, Stable adaptive systems, Dover; [6] S. P. Karason, and A. M. Annaswamy, Adaptive control in the presence of input constraints, American Control Conference, [7] M. Schwager, A. M. Annaswamy, and E. Lavretsky, Adaptation-based reconfiguration in the presence of actuator failures and saturation, Proceedings of the 2005 American Control Conference, 2005, IEEE, [8] E. Lavretsky, and N. Hovakimyan, Stable adaptation in the presence of input constraints, Systems & Control Letters, vol. 56 no.11, pp , [9] National Transportation Safety Board (USA) (2010) Aircraft Accident Report: Loss of Thrust in Both Engines After Encountering a Flock of Birds and Subsequent Ditching on the Hudson River, US Airways Flight 1549, Airbus A , N106US, Weehawken, New Jersey, January 15, 2009, Washington DC. NTSB/AAR-10 /03 [10] Netherland Aviation Safety Board (Netherland) (1994) Aircraft Accident Report: El Al flight 1862, Boeing f 4x-axg, October 4, 1992, Amsterdam, Bijlmermeer, [11] National Transportation Safety Board (USA) (1989) Aircraft Accident Report: Delta Air Lines, Inc. Boeing , N473DA, Dallas-Fort Worth International Airport, Texas, August 31, 1989, Washington DC. NTSB/AAR-89/04 [12] National Transportation Safety Board (USA) (1982) Aircraft Accident Report: Air Florida, Inc., Boeing , N62AF, Collision with 14th Street Bridge, Near Washington National Airport, Washington, D.C., January , Washington DC. NTSB-AAR-82-8 [13] R. Hosman, and H. Stassen, Pilot's perception in the control of aircraft motions, Control Engineering Practice, vol. 7, no. 11, pp , [14] D. McRuer, Human dynamics in man-machine systems, Automatica vol. 16, no. 3, pp , [15] R. A. Hess, Simplified approach for modelling pilot pursuit control behaviour in multi-loop flight control tasks, Proceedings of the Institution of Mechanical Engineers, Part G: Journal of Aerospace Engineering, vol. 220, no. 2, pp , [16] R. A. Hess, Modeling pilot control behavior with sudden changes in vehicle dynamics, Journal of Aircraft, vol. 46, no.5, pp , Sep [17] R. A. Hess, Modeling Human Pilot Adaptation to Flight Control Anomalies and Changing Task Demands, Journal of Guidance, Control, and Dynamics, [18] D. D. Woods and N. Sarter, Learning from Automation Surprises and Going Sour Accidents, in Cognitive Engineering in the Aviation Domain, N. Sarter and R. Amalberti, Eds. Hillsdale NJ: Erlbaum, pp , [19] A. B. Farjadian, A. M. Annaswamy and D. D. Woods, A Resilient Shared Control Architecture for Flight Control, Proceedings of the International Symposium on Sustainable Systems and Technologies, [20] A. B. Farjadian, A. M. Annaswamy, D. D. Woods, Bumpless Reengagement Using Shared Control between Human Pilot and Adaptive Autopilot, IFAC Proceedings, Toulouse, France, Jul [21] T.G. Lee and U.Y. Huh, An error feedback model based adaptive controller for nonlinear systems, in Proc. IEEE Int. Symp. Ind. Electron., pp , Jul [22] E. Lavretsky, Adaptive output feedback design using asymptotic properties of LQG/LTR controllers, in Proc. AIAA Guid. Navigat. Control Conf., no. AIAA, pp , [23] T. E. Gibson, A. M. Annaswamy, and E. Lavretsky, On adaptive control with closed-loop reference models: transients, oscillations, and peaking, IEEE Access 1, pp , [24] A. E. Bryson, "Optimal control-1950 to 1985." IEEE Control Systems, vol. 16, no. 3, pp , [25] E. Lavretsky, & K. A. Wise, Robust and Adaptive Control. Springer London, 2013, pp [26] L. Guohua, Pilot-related factors in aircraft crashes: a review of epidemiologic studies, Aviation, Space, and Environmental Medicine, [27] D. P. Wiese, A. M. Annaswamy, J. A. Muse, M. A. Bolender, & E. Lavretksy, Sequential Loop Closure Based Adaptive Output Feedback, IEEE Access, [28] P. Kapasouris, M. Athans and G. Stein, Design of feedback control systems for unstable plants with saturating actuators, Proc. IFAC Symp. on Nonlinear Control System Design, Pergamon Press, pp , [29] C.G. Rieger, Notional examples and benchmark aspects of a resilient control system, In: Proceedings of the IEEE, 3rd international symposium on resilient control systems (ISRCS), pp , [30] National Transportation Safety Board. (1994). In-flight Icing Encounter and Loss of Control Simmons Airlines, d.b.a. American Eagle Flight 4184 Avions de Transport Regional (ATR) Model , N401AM. Aircraft Accident Report NTSB/AAR-96/01. Washington, DC.

14 [31] R.J. Stephens, D. D. Woods and E. S. Patterson, Patient Boarding in the Emergency Department as a Symptom of Complexity-Induced Risks. In Resilience in Everyday Clinical Work. R.L. Wears, E. Hollnagel, J. Braithwaite, Eds., Farnham, UK: Ashgate, pp , [32] T. S. Carretta, D. C. Perry Jr, & M. J. Ree, Prediction of situational awareness in F-15 pilots, The International Journal of Aviation Psychology, pp , [33] J. L. Taylor, Q. Kennedy, A. Noda, & J. A. Yesavage, Pilot age and expertise predict flight simulator performance A 3-year longitudinal study, Neurology, pp , [34] Sarter N. and Woods, D.D. (1992). Pilot Interaction with Cockpit Automation I: Operational Experiences with the Flight Management System. International Journal of Aviation Psychology, 2: [35] Sarter N. and Woods, D.D. (1994). Pilot Interaction with Cockpit Automation II: An Experimental Study of Pilot's Model and Awareness of the Flight Management System. International Journal of Aviation Psychology, 4:1 28. [36] Sarter N. B. and Woods, D. D. (1995). How in the world did we get into that mode? Mode error and awareness in supervisory control. Human Factors, 37: [37] Sarter, N. and Woods, D.D. (1997). Team play with a Powerful and Independent Agent: A Corpus of Operational Experiences and Automation Surprises on the Airbus A-320. Human Factors, 39, [38] Sarter, N. and Woods, D.D. (2000). Team Play with a Powerful and Independent Agent: A Full Mission Simulation. Human Factors, 42, [39] Sklar, A. E. and Sarter, N. (1999). Good Vibrations: Tactile Feedback in Support of Attention Allocation and Human-Automation Coordination in Event-Driven Domains Human Factors, 41(4), [40] Abbott, K., McKenney, D. and Railsback, P. (2013). Operational Use of Flight Path Management Systems. Final report of the Flight Deck Automation Working Group, Performance-based operations Aviation Rulemaking Committee PARC / Commercial Aviation Safety Team CAST / FAA. /avs/offices/afs/afs400/parc/ [41] M. Mulder, D.M. Pool, D.A. Abbink, E.R. Boer, and M.M. van Paassen, Manual Control Cybernetics: Stateof-the-Art and Current Trends, IEEE Transaction on Human-Machine Systems, pp , [42] A. Jain, R. Bansal, A. Kumar, & K. D. Singh, A comparative study of visual and auditory reaction times on the basis of gender and physical activity levels of medical first year students, International Journal of Applied and Basic Medical Research, pp.124, Dr. Amir B. Farjadian received his B.S. degree in biomedical engineering from Azad University, Tehran, Iran in 2003, the M.S. degree in biomedical engineering from Iran University of Science and Technology (IUST), Tehran, Iran in 2006, and the PhD in bioengineering from Northeastern University, Boston, MA, USA in He is currently a postdoctoral associate at Massachusetts Institute of Technology (MIT), Cambridge, MA, USA, pursuing research in human-machine cognitive interaction, and resilient shared human-machine control systems. Benjamin Thomsen is a graduate student in the Department of Mechanical Engineering at the Massachusetts Institute of Technology, where he is a researcher in the Active Adaptive Control Laboratory. He received his B.Eng. in Mechanical Engineering from McGill University in His research interests lie in the area of motion planning and control for autonomous aerial vehicles, with the goal of ensuring stable and consistent UAV behavior in the presence of uncertain vehicle dynamics. Dr. Anuradha M. Annaswamy received her Ph.D. in Electrical Engineering from Yale University in She has been a member of the faculty at Yale, Boston University, and MIT where currently she is the director of the Active-Adaptive Control Laboratory and a Senior Research Scientist in the Department of Mechanical Engineering. Her research interests pertain to adaptive control theory and applications to aerospace, automotive, and propulsion systems, cyber physical systems science, and CPS applications to Smart Grids, Smart Cities, and Smart Infrastructures. She is the author of a hundred journal publications and numerous conference publications, co-author of a graduate textbook on adaptive control (2004), co-editor of several reports including Systems & Control for the future of humanity, research agenda: Current and future roles, impact and grand challenges, (Elsevier) IEEE Vision for Smart Grid Control: 2030 and Beyond, (IEEE Xplore) and Impact of Control Technology, (ieeecss.org/main/ioct-report, ieeecss.org/general/ioct2-report). Dr. Annaswamy has received several awards including the George Axelby and Control Systems Magazine best paper awards from the IEEE Control Systems Society (CSS), the Presidential Young Investigator award from NSF, the Hans Fisher Senior Fellowship from the Institute for Advanced Study at the Technische Universität München, the Donald Groen Julius Prize from the Institute of Mechanical Engineers, a Distinguished Member Award, and a Distinguished Lecturer Award from IEEE CSS. Dr. Annaswamy is a Fellow of the IEEE and IFAC. She has served as the Vice President for Conference Activities ( ), and is currently serving as the VP for Technical Activities ( ) in the Executive Committee of the IEEE CSS. She is the Deputy Editor of the

15 Elsevier publication Annual Reviews in Control (2016- present). David D. Woods PhD Purdue University, He is Professor in Integrated Systems Engineering at the Ohio State University, Columbus OH, USA. His work on safety in high risk, complex settings is found in the books Behind Human Error (1994; 2nd Edition 2010), Joint Cognitive Systems (Foundations, 2005; Patterns, 2006). Resilience Engineering: Concepts and Precepts (2006), Resilience Engineering in Practice (2011). He studies of human coordination with automated and intelligent systems and accident investigations in aviation, nuclear power, critical care medicine, crisis response, military operations, outages of critical digital services, and space operations (he was an advisor to the Columbia Accident Investigation Board). He began developing Resilience Engineering in as part of the response to several NASA accidents. Dr. Woods is Past-President of the Resilience Engineering Association and also Past-President of the Human Factors and Ergonomics Society. He has received many awards such as a Laurels Award from Aviation Week and Space Technology (1995), the Jimmy Doolittle Fellow Award from the Air Force Association, and served on many national advisory committees such as National Research Council committees on Dependable Software (2006), and on Autonomy in Civil Aviation (2014), the FAA Human Factors and Cockpit Automation Team (1996; and its reprise in 2013), the Defense Science Board Task Force on Autonomy (2012).